Attacks/Breaches
1/2/2014
07:38 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Snapchat To Update App In Wake Of Breach

App vendor planning new version that lets users opt out of appearing in beleagured 'Find Friends' feature

Snapchat, a mobile photo-messaging app created for wiping out traces of the messages for privacy reasons, this week was hit with a major breach of its users' privacy that exposed names and phone numbers of some 4.6 million of its customers. The data dump came after security researchers published a proof-of-concept for a weakness associated with the "Find Friends" feature.

The app provider late today announced that it would update Snapchat to better protect its users. "We will be releasing an updated version of the Snapchat application that will allow Snapchatters to opt out of appearing in Find Friends after they have verified their phone number. We’re also improving rate limiting and other restrictions to address future attempts to abuse our service," Snapchat said in a blog post.

Snapchat also said researchers could email the firm at security@snapchat.com for any vulnerability discoveries. "We want to make sure that security experts can get a hold of us when they discover new ways to abuse our service so that we can respond quickly to address those concerns. The best way to let us know about security vulnerabilities is by emailing us: security@snapchat.com," Snapchat said.

The blog post came in response to criticism by the researchers who first reported and then published details on the flaw in Snapchat's app after saying they had not gotten a response from Snapchat. A hacker group yesterday exploited the flaw and posted online to a site called SnapchatDB the names and phone numbers, with the final two digits obscured, on some 2.6 million Snapchat users.

"As much as we were hoping it wouldn't be exploited, we did expect at least something to come of it. We don't condone the Snapchat DB leak, and feel that it's a pretty reckless way to get across the point to Snapchat," researchers at Gibson Security told Dark Reading in an email interview.

The researchers say they tried to contact Snapchat in August electronically before their original post about the flaw. On Dec. 27, Snapchat posted a blog basically dismissing the vulnerabilities. "This week, on Christmas Eve, a security group posted documentation for our private API. This documentation included an allegation regarding a possible attack by which one could compile a database of Snapchat usernames and phone numbers," Snapchat said in that post. "Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way. Over the past year we’ve implemented various safeguards to make it more difficult to do. We recently added additional counter-measures and continue to make improvements to combat spam and abuse."

Find Friends basically lets users upload their contacts list to Snapchat so that Snapchat can display the accounts of users that match those phone numbers.

Gibson Security said Snapchat's director of operations contacted them via email, but that they hadn't heard anything since then as of this morning.

The breach of user information is another example of the risks associated with many mobile apps today, security experts say. "In a rush for growth, companies often put security on the back burner. Snapchat here is no exception. What we see here is a classic example of how the intersection of social media, mobile platforms, and cloud create new entry doors for the hackers to exploit. Today’s rapid moving parts and the plethora of connections make it all too easy for the attackers," says Bala Venkat, CMO at Cenzic.

Kevin O’Brien, director of product marketing at CloudLock, says this low bar of entry into the mobile app space basically complicates security. The Snapchat customer data dump has damage potential to the users, he says.

"Spoofed phone calls" are one potential abuse, he says, as well as criminals using the phone numbers, geographic information, and usernames for identity theft or to escalate victims' user privileges elsewhere. "PII [personally identifiable information] is valuable. It allows you to get closer to the target," O'Brien says.

Gibson Security, meanwhile, suggests users delete their Snapchat accounts or contact their mobile phone network providers to change their phone numbers if they are especially concerned those numbers could be fully discerned by prospective attackers. "They should definitely ensure their security and privacy settings are up to date and well adjusted in all their social media accounts. Users should perform due diligence when registering for new social media accounts -- if a site doesn't deserve [or shouldn't have] your phone number, don't give it to them," the researchers say.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.